Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning

Christoph Hellwig
2008-08-05T00:54:49Z

On Mon, Aug 04, 2008 at 08:47:04PM -0400, Eric Paris wrote:
> On Mon, 2008-08-04 at 20:26 -0400, Christoph Hellwig wrote:
> > On Mon, Aug 04, 2008 at 03:32:49PM -0700, Greg KH wrote:
> > > > 1. Intercept file opens (exec also) for vetting (block until
> > > > decision is made) and allow some userspace black magic to make
> > > > decisions.
> >
> > NACK, this kind of policy should be done in kernelspace.
>
> What? You want to write and in kernel scanner for Window viruses?

No, I want a sane security policy in kernelsapce that doesn't look
at the content because doing security by content properly is equivalent
to solving the halting problem. I couldn't give a rats a** about
windows viruses as they can't actually cause any harm on a Linux
machine.

> >
> > > > 6. Scan files directly not relying on path. Avoid races and problems with namespaces, chroot, containers, etc.
> >
> > Explain?
>
> The data connected with the file being opened must as reasonably as
> possible be the data the 'scanner' looks at. Some foolish early
> discussion wanted to do simplistic things like pass a pathname to a
> scanner and have it call open on that path name. I'm willing to
> entertain any other method of making the scanner look at the data the
> process is about to get.

Well, data can change all the time, as can the path name. This whole
content scanning thing doesn't make any sense at all.

> > > > 9. Mark a processes as exempt from on access scanning
> >
> > Nack, this completely defeats the purpose.
>
> What? it allows a process to open a file that contains malware, how is
> that horrible. If a process says "I want to see malware" it can then
> see malware. Doesn't in any way affect other processes or the system
> security as a whole. If 'bad' data gets into a file its going to get
> blocked from everything that doesn't actively choose to see it.

So make this opt-in and in userspace. Just LD_PRELOAD some monster lib
doing all the horrible things you propose and use it wherever you want.